From 50a5cb66734919c0ee764324434e080b3699b4ae Mon Sep 17 00:00:00 2001 From: madhur310 Date: Mon, 2 Nov 2026 14:13:18 -0800 Subject: [PATCH 1/3] feat(release): add OIDC trusted-publishing support to vscode-publish-release-vsix.yml - W-24756661 Adds an opt-in `oidc` input (default false, PAT path unchanged) so callers can publish via `vsce publish --oidc` instead of a VSCE_PERSONAL_ACCESS_TOKEN. Kept as a toggle rather than a straight swap (unlike the Open VSX migration) because this is genuinely untested: Microsoft only shipped Marketplace Trusted Publishing on 2026-10-28, and it's unknown yet whether the Marketplace matches the OIDC token's workflow_ref or job_workflow_ref claim when the publish step runs nested inside this cross-repo reusable workflow. --- .../workflows/vscode-publish-release-vsix.yml | 28 +++++++++++++++++-- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/.github/workflows/vscode-publish-release-vsix.yml b/.github/workflows/vscode-publish-release-vsix.yml index 979afbf..0cef4e4 100644 --- a/.github/workflows/vscode-publish-release-vsix.yml +++ b/.github/workflows/vscode-publish-release-vsix.yml @@ -12,10 +12,19 @@ on: required: false default: false type: boolean + oidc: + description: > + Publish via OIDC trusted publishing (vsce --oidc) instead of a PAT. Requires a Trusted + Publishing policy registered for this caller's repo/workflow on the Marketplace + publisher management page, and the caller job must grant `id-token: write`. + TEMPORARY/experimental while this is being validated end-to-end -- see W-24756661. + required: false + default: false + type: boolean secrets: VSCE_PERSONAL_ACCESS_TOKEN: - description: VS Code Marketplace publishing token - required: true + description: VS Code Marketplace publishing token. Not used when `oidc` is true. + required: false permissions: contents: read @@ -23,6 +32,10 @@ permissions: jobs: publish: runs-on: ubuntu-latest + permissions: + contents: read + # Only exchanged for a Marketplace token when `oidc` is true; otherwise unused. + id-token: write steps: - name: Download release VSIXs id: release @@ -34,6 +47,7 @@ jobs: env: DRY_RUN: ${{ inputs.dry-run }} PRE_RELEASE: ${{ steps.release.outputs.pre-release }} + OIDC: ${{ inputs.oidc }} VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }} run: | # Marketplace gallery requests can sit until typed-rest-client's 180s @@ -59,13 +73,21 @@ jobs: if [ "$PRE_RELEASE" = true ]; then args+=(--pre-release) fi + if [ "$OIDC" = true ]; then + args+=(--oidc) + fi if [ "$DRY_RUN" = true ]; then echo "Would publish $vsix to the VS Code Marketplace: @vscode/vsce publish ${args[*]}" continue fi - if ! VSCE_PAT="$VSCE_PERSONAL_ACCESS_TOKEN" publish_with_retry npx @vscode/vsce publish "${args[@]}"; then + if [ "$OIDC" = true ]; then + if ! publish_with_retry npx @vscode/vsce publish "${args[@]}"; then + echo "::error::Failed to publish $vsix after 3 attempts" + exit 1 + fi + elif ! VSCE_PAT="$VSCE_PERSONAL_ACCESS_TOKEN" publish_with_retry npx @vscode/vsce publish "${args[@]}"; then echo "::error::Failed to publish $vsix after 3 attempts" exit 1 fi From fce190fdc44ab773c1a801710f9bcd77e0ff22bb Mon Sep 17 00:00:00 2001 From: madhur310 Date: Mon, 2 Nov 2026 16:25:23 -0800 Subject: [PATCH 2/3] feat(release): add vsix-name-pattern/exclude-web-vsix to vscode-publish-release-vsix.yml - W-24756661 Mirrors openvsx-publish-release-vsix.yml's filtering inputs (behavior-preserving defaults). Needed so apex-language-support's OIDC test workflow can exclude its web VSIX variant, same as its Open VSX equivalent already does. --- .../workflows/vscode-publish-release-vsix.yml | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.github/workflows/vscode-publish-release-vsix.yml b/.github/workflows/vscode-publish-release-vsix.yml index 0cef4e4..4173c60 100644 --- a/.github/workflows/vscode-publish-release-vsix.yml +++ b/.github/workflows/vscode-publish-release-vsix.yml @@ -21,6 +21,16 @@ on: required: false default: false type: boolean + vsix-name-pattern: + description: Glob of downloaded VSIX file names to publish + required: false + default: '*.vsix' + type: string + exclude-web-vsix: + description: Exclude *-web-* VSIXs from publishing + required: false + default: 'false' + type: string secrets: VSCE_PERSONAL_ACCESS_TOKEN: description: VS Code Marketplace publishing token. Not used when `oidc` is true. @@ -48,6 +58,8 @@ jobs: DRY_RUN: ${{ inputs.dry-run }} PRE_RELEASE: ${{ steps.release.outputs.pre-release }} OIDC: ${{ inputs.oidc }} + VSIX_PATTERN: ${{ inputs.vsix-name-pattern }} + EXCLUDE_WEB: ${{ inputs.exclude-web-vsix }} VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }} run: | # Marketplace gallery requests can sit until typed-rest-client's 180s @@ -91,4 +103,10 @@ jobs: echo "::error::Failed to publish $vsix after 3 attempts" exit 1 fi - done < <(find extensions -type f -name '*.vsix' -print0) + done < <( + if [ "$EXCLUDE_WEB" = "true" ]; then + find extensions -type f -name "$VSIX_PATTERN" ! -iname '*-web-*' -print0 + else + find extensions -type f -name "$VSIX_PATTERN" -print0 + fi + ) From 7eb9b4b141e7e6a322d608cf7eeaa771ca242827 Mon Sep 17 00:00:00 2001 From: madhur310 Date: Tue, 3 Nov 2026 12:42:58 -0800 Subject: [PATCH 3/3] fix(release): drop the oidc toggle, straight-swap vscode-publish-release-vsix.yml - W-24756661 The toggle was unnecessary: publishVSCode.yml (the real caller) is pinned to @main, so it was already fully isolated from whatever this branch does -- the @branch pin on the test workflow gave the same safety a toggle would, for free. Matches the Open VSX migration's pattern: test via a branch-pinned straight swap, only merge to main once validated. --- .../workflows/vscode-publish-release-vsix.yml | 32 +++---------------- 1 file changed, 5 insertions(+), 27 deletions(-) diff --git a/.github/workflows/vscode-publish-release-vsix.yml b/.github/workflows/vscode-publish-release-vsix.yml index 4173c60..f61fccd 100644 --- a/.github/workflows/vscode-publish-release-vsix.yml +++ b/.github/workflows/vscode-publish-release-vsix.yml @@ -12,15 +12,6 @@ on: required: false default: false type: boolean - oidc: - description: > - Publish via OIDC trusted publishing (vsce --oidc) instead of a PAT. Requires a Trusted - Publishing policy registered for this caller's repo/workflow on the Marketplace - publisher management page, and the caller job must grant `id-token: write`. - TEMPORARY/experimental while this is being validated end-to-end -- see W-24756661. - required: false - default: false - type: boolean vsix-name-pattern: description: Glob of downloaded VSIX file names to publish required: false @@ -31,10 +22,6 @@ on: required: false default: 'false' type: string - secrets: - VSCE_PERSONAL_ACCESS_TOKEN: - description: VS Code Marketplace publishing token. Not used when `oidc` is true. - required: false permissions: contents: read @@ -44,7 +31,8 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - # Only exchanged for a Marketplace token when `oidc` is true; otherwise unused. + # vsce exchanges this job's OIDC ID token for a short-lived Marketplace publishing token + # (--oidc below) -- without this, there is no token to exchange. id-token: write steps: - name: Download release VSIXs @@ -57,10 +45,8 @@ jobs: env: DRY_RUN: ${{ inputs.dry-run }} PRE_RELEASE: ${{ steps.release.outputs.pre-release }} - OIDC: ${{ inputs.oidc }} VSIX_PATTERN: ${{ inputs.vsix-name-pattern }} EXCLUDE_WEB: ${{ inputs.exclude-web-vsix }} - VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }} run: | # Marketplace gallery requests can sit until typed-rest-client's 180s # socket timeout. vsce has no timeout flag; retry per VSIX. @@ -81,25 +67,17 @@ jobs: } while IFS= read -r -d '' vsix; do - args=(--packagePath "$vsix" --skip-duplicate) + args=(--packagePath "$vsix" --oidc --skip-duplicate) if [ "$PRE_RELEASE" = true ]; then args+=(--pre-release) fi - if [ "$OIDC" = true ]; then - args+=(--oidc) - fi if [ "$DRY_RUN" = true ]; then - echo "Would publish $vsix to the VS Code Marketplace: @vscode/vsce publish ${args[*]}" + echo "Would publish $vsix to the VS Code Marketplace with --skip-duplicate: @vscode/vsce publish ${args[*]}" continue fi - if [ "$OIDC" = true ]; then - if ! publish_with_retry npx @vscode/vsce publish "${args[@]}"; then - echo "::error::Failed to publish $vsix after 3 attempts" - exit 1 - fi - elif ! VSCE_PAT="$VSCE_PERSONAL_ACCESS_TOKEN" publish_with_retry npx @vscode/vsce publish "${args[@]}"; then + if ! publish_with_retry npx @vscode/vsce publish "${args[@]}"; then echo "::error::Failed to publish $vsix after 3 attempts" exit 1 fi